Microsoft Office for Android CVE-2026-45649

Exploitation requires local access to an Android device with Microsoft Office for Android installed (AV:L) and user interaction (UI:R) - typically the victim opening a crafted document or tapping a prompt rendered by Office. No authentication to Office or to a Microsoft 365 account is required by the attacker (PR:N), but the attacker must already be able to deliver content into the Office app's context, for example via a malicious file shared through email/messaging, a sideloaded or co-installed Android app sending crafted intents, or a link that hands off to Office. Limiting factors: the attack does not work purely over the network without on-device interaction, it is constrained to the Android platform build of Office, and exact vulnerable versions are gated behind the MSRC advisory.

The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N points to a locally exploitable issue requiring user interaction but no privileges, with high confidentiality and integrity impact and no availability impact - consistent with a spoofing/access-control flaw that influences what the user sees and trusts. The 7.1 score is meaningful but should be weighed against the AV:L constraint: an attacker generally needs a foothold on the device (another installed app, a delivered document, or a malicious link the user opens in Office). EPSS data was not provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so this currently reads as a real but not yet urgently exploited issue. The 'Authentication Bypass' tag combined with CWE-284 raises the concern that spoofing could be chained with phishing or document-based social engineering for higher real-world impact than the AV:L vector alone implies.

An attacker delivers a crafted Office document or installs a malicious companion app on the victim's Android device, then lures the user to open the file or tap a prompt in Office for Android; the access control flaw causes Office to render attacker-controlled content as if it came from a trusted source (e.g., a known sender, signed document, or legitimate dialog), enabling credential phishing or fraudulent approval of a transaction. Because user interaction is required and no public PoC is currently known, the most realistic delivery is a targeted social-engineering chain rather than mass exploitation.